CVE-2026-97949
Received Received - Intake

configfs Directory Traversal in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97949
EUVD
EUVD-2026-86803

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's configfs subsystem. It occurs when a dentry (directory entry) remains hashed after an item is removed, allowing a race condition where another operation can access freed memory. The issue stems from configfs_rmdir() not unhashing the dentry before dropping the item, leading to a stale reference in configfs_symlink().

Detection Guidance

This vulnerability is specific to the Linux kernel's configfs subsystem and requires kernel-level detection. Check kernel logs for slab-use-after-free errors related to configfs_symlink or config_item_get. Commands like dmesg | grep -i 'KASAN\|configfs\|use-after-free' may help identify exploitation attempts or crashes.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service (system crash) by exploiting the race condition. It may lead to memory corruption, system instability, or unauthorized access if successfully exploited.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-97949. Monitor kernel security advisories and apply updates promptly. If immediate patching is not possible, restrict access to configfs functionality or disable it if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97949. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart